Libraries Unlocked requires a software/hardware solution for controlling the library during unstaffed periods allowing recognised library members access to the building with the ability to carry out all normal library functions. Personal information is collected via the Library Management systems. The services process personal information to manage and administer Libraries Unlocked either directly or jointly with partners and commissioned private and third sector providers. CCTV will be in place to monitor and record all activity within the library for the purposes of security. 

This includes:

• delivering library services including:
  • general library membership and use
• independent use of services during Libraries unlocked hours including swipe access control
• to confirm identity to provide services
• to contact and communicate with individuals. This is agreed through application as to how individuals want to be contacted or not at all
• to meet various legal requirements and statutory obligations in relation to library service delivery
• for general processing where consent for us to do so has been agreed
• to ensure that library bylaws are being followed and the safety of users in the library
• preventing or detecting fraud or crime
• research using anonymised personal data. If we wish to use your identifiable personal data we will seek your permission

The service processes personal information which is relevant to individual cases which may include, but is not limited to, the following personal data:

• your personal details including name, address, date of birth, home and mobile phone numbers, email address, emergency contact name and number
• library card number
• people captured through CCTV monitoring/recording
• alternative contact details and meeting location for groups

We may also process some special category (sensitive) information through CCTV monitoring/recording, including:

• physical health details
• racial or ethnic origin

The legal bases for processing this personal information are:

• Consent (UK GDPR Article 6 (1)(a)) – the individual has given clear consent for research questionnaires
• Contract (UK GDPR Article 6 (1)(b)) – processing is necessary for the performance of a contract to which the data subject is a party
• Legal obligation (UK GDPR Article 6 (1)(c)) – processing is necessary to comply with the law outlined in:
  • Public Libraries and Museums Act 1964
• Public task (UK GDPR Article 6 (1)(e)) – processing is necessary to perform a task in the public interest

The special category condition for processing is:

• Legal claims and judicial acts (UK GDPR Article 9 (2)(f)) – processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
• Reasons of substantial public interest (UK GDPR Article 9 (2)(g)) – processing is necessary for preventing or detecting unlawful acts (condition 10 of Schedule 1 of the DPA 2018), protecting the public against dishonesty etc. (condition 11 of Schedule 1 of the DPA 2018) and insurance (condition 20 of Schedule 1 of the DPA 2018)

There is no planned regular sharing of CCTV footage with any external organisation. However, we may need to share the personal information you have given to us or we’ve collected about you (including CCTV footage) with partner organisations where relevant to the individual and/or their service provision (for instance in the event of a security incident or a suspect security incident). 

These include but are not limited to:

• other Worcestershire County Council services as appropriate, including Legal Services
• National Regulators and Agencies
• Emergency Services e.g., Police and Fire Service as and when required. A request to external organisation for the disclosure of personal data to the police form will be completed

Information will only ever be shared when it is strictly necessary to help us provide effective services. We will not pass it onto any other parties unless required to do so by law or in all reasonable circumstances the disclosure is fair and warranted for the purposes of processing or subject to a data protection exemption.

We have specific data sharing agreements in place with local agencies and sometimes the law requires that we may have to pass your details on to a third party, for example, to prevent crime.

We retain your personal information for 2 years after your membership of the library ceases. Inter library loan request forms are disposed of as soon as the loan request has been fulfilled.

CCTV records will be deleted between 10 and 30 days of the recording depending on the library recording system. These will only be viewed by trained staff within the library as and when a need has been raised. Images and information obtained from the surveillance camera system will not be kept for longer than necessary to fulfil the purpose for which they were obtained in the first place.

More information about our retention periods can be found in our summary Disposal Schedule.

Please note stated retention periods may be subject to any legal holds imposed under the Inquiries Act 2005 that may concern the information and override standard retention periods.

You are entitled to a copy, or a description, of the personal data we hold that relates to you, subject to lawful restrictions. Please go to our Make a Data Protection Request webpage to find out how to make a request.

You may be entitled to rectification, restriction, objection, and erasure of your personal information depending on the service and legal basis. Please in the first instance contact CBrown@worcestershire.gov.uk, Service Manager Libraries & Culture, to exercise these Information Rights or call the main Worcestershire County Council contact telephone number of 01905 765765.

Please see our overarching Privacy Notice for further contact details and if you have a complaint about your information rights.